Pin every third-party action in .github/workflows/ to a full commit SHA
with a trailing version comment, and bump to the latest stable release.
Defends against tag-rewrite supply-chain attacks while keeping versions
legible.
- toArray() falls back to Config::getParam('platform') when the
in-memory platform is empty, matching the old Build event behavior so
workers always receive a populated platform array.
- toArray() emits null for an absent template instead of an empty
array, and fromArray() treats empty/null/missing template as null so
the round-trip preserves the no-template case.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Replace directive-extraction approach with word-boundary regex matching
so plain-word patterns like "skip appwrite" and "appwrite skip" work
alongside bracket directives. Use \s+ between word tokens (required
space) and \s* only after ":" tokens (git trailer flexibility).
Add tests for "skip appwrite" and "appwrite skip" with case insensitivity.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaces the stateful Appwrite\Event\Build queue class with a stateless
BuildPublisher and BuildMessage DTO, matching the publisher pattern used
by audits, certificates, executions, migrations, screenshots, stats, and
usage. Call sites now enqueue messages directly instead of mutating a
shared event object and relying on the API shutdown hook.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
ProjectWebhooks: bump assertEventually timeouts from 15s to 30/60s. Under
ParaTest with 4 parallel processes the column/attribute worker can take
longer than the original 15s budget to flip status to 'available', which
manifested as a flaky 'available' vs 'processing' assertion in
testUpdateRow on retry. The 60s budget covers attribute and column
provisioning; the 30s budget covers webhook delivery and auto-disable
polling. The function deployment build keeps its existing 120s budget.
Proxy: testCreateRedirectRule was deleting the site before its rules and
only tracking one of two created rule IDs, so cleanupRule hit a 404 because
the site cascade had already removed the rule. Track both rule IDs
distinctly (301 and 307) and clean rules up before the site so cleanup is
deterministic regardless of cascade behaviour.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
PHPStan flagged $payload as undefined in StatsResources::action — the gauges
fast path was reading from a variable that never existed, so the optimization
silently no-op'd and always fell through to the full count. Add a typed
$gauges field to the StatsResources message DTO so the worker reads the
pre-computed metrics from the parsed envelope, and drop redundant null
coalescing on the array{metric, value} shape since PHPStan now proves the
keys exist.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds Executor\Exception\Timeout (with timeoutSeconds) and translates it at
each call site into BUILD_TIMEOUT, FUNCTION_SYNCHRONOUS_TIMEOUT, or
FUNCTION_ASYNCHRONOUS_TIMEOUT instead of always using the misleading sync
function error. Build timeouts now append to streamed buildLogs rather
than replacing them, and the build worker reports its timeout via Span.
Matej Bačo
Levi van Noort
Jake Barnby
ArnabChatterjee20k
loks0nandClaude Opus 4.7
harsh mahajanandClaude Sonnet 4.6
Harsh Mahajan
Prem Palanisamy
ArnabChatterjee20k
Matej Bačo